fix(playback): keep Tigris media private

Author: richiemcilroy

apps/site/app/embed-fast/[assetId]/route.ts

@@ -95,10 +95,11 @@ test("fast embed falls back to the real opener when inline startup is unavailabl
   });
 
   assert.match(html, /src="https:\/\/api\.rend\.so\/v\/00000000-0000-0000-0000-000000000001\/opener\.mp4"/);
-  assert.match(html, /rel="preload" as="video" href="https:\/\/api\.rend\.so\/v\/00000000-0000-0000-0000-000000000001\/opener\.mp4" type="video\/mp4" crossorigin="use-credentials" fetchpriority="high"/);
+  assert.match(html, /rel="preload" as="video" href="https:\/\/api\.rend\.so\/v\/00000000-0000-0000-0000-000000000001\/opener\.mp4" type="video\/mp4" fetchpriority="high"/);
   assert.match(html, /data-rend-player-selected="opener"/);
   assert.match(html, /data-rend-player-artifact="opener\.mp4"/);
   assert.doesNotMatch(html, /src="[^"]*progressive\.mp4"/);
+  assert.doesNotMatch(html, /crossorigin="use-credentials"/);
   assert.doesNotMatch(html, /playback_token|set-cookie|authorization/i);
 });
 
@@ -244,21 +245,19 @@ test("fast embed route forwards bootstrap cookies to the document response by de
     assert.equal(response.headers.get("cache-control"), "no-store");
     assert.equal(response.headers.get("x-rend-fast-embed"), "1");
     assert.match(response.headers.get("link") ?? "", /rel=preconnect/);
-    assert.match(response.headers.get("link") ?? "", /hls\/360p\/segment_00001\.m4s/);
-    assert.match(response.headers.get("link") ?? "", /rel=preload; as=fetch/);
+    assert.match(response.headers.get("link") ?? "", /opener\.mp4/);
+    assert.match(response.headers.get("link") ?? "", /rel=preload; as=video/);
     assert.match(response.headers.get("set-cookie") ?? "", /__rend_playback=/);
     assert.equal(
       fetches[0]?.url,
       `https://www.rend.so/api/player/${ASSET_ID}`,
     );
     assert.equal(fetches[0]?.headers.get("x-vercel-ip-country"), "GB");
-    assert.match(fetches[1]?.headers.get("cookie") ?? "", /__rend_playback=/);
-    assert.match(fetches[1]?.headers.get("cookie") ?? "", /CloudFront-Policy=policy_value/);
-    assert.match(fetches[1]?.headers.get("cookie") ?? "", /CloudFront-Signature=signature_value/);
-    assert.match(fetches[1]?.headers.get("cookie") ?? "", /CloudFront-Key-Pair-Id=key_pair/);
+    assert.equal(fetches.length, 1);
     assert.match(body, /autoplay/);
     assert.doesNotMatch(body, /controls/);
-    assert.match(body, /mse_inline/);
+    assert.match(body, /data-rend-player-selected="opener"/);
+    assert.doesNotMatch(body, /crossorigin="use-credentials"/);
     assert.doesNotMatch(body, /playback_token|authorization/i);
   } finally {
     globalThis.fetch = originalFetch;

apps/site/app/embed-fast/route.test.mts

@@ -4,6 +4,7 @@ import {
   initialPlaybackState,
   initialSourceSelection,
   playbackCrossOrigin,
+  scriptedHlsAllowed,
   startupPreloadHints,
   watchHeartbeatDelta,
 } from "./player-engine.ts";
@@ -87,7 +88,19 @@ test("startup preload hints avoid duplicating native HLS startup requests", () =
       hint.crossOrigin,
       hint.url,
     ]),
-    [["thumbnail.jpg", "image", "use-credentials", "https://ash-1.play.rend.so/v/asset/thumbnail.jpg"]]
+    [["thumbnail.jpg", "image", undefined, "https://ash-1.play.rend.so/v/asset/thumbnail.jpg"]]
+  );
+});
+
+test("private Tigris media uses credentialed no-CORS playback", () => {
+  assert.equal(playbackCrossOrigin(READY_BOOTSTRAP), undefined);
+  assert.equal(scriptedHlsAllowed(READY_BOOTSTRAP, "https://www.rend.so/watch/asset"), false);
+  assert.equal(
+    scriptedHlsAllowed(
+      { ...READY_BOOTSTRAP, manifest_url: "https://www.rend.so/api/player/asset/master.m3u8" },
+      "https://www.rend.so/watch/asset",
+    ),
+    true,
   );
 });
 
@@ -102,6 +115,7 @@ test("public playback uses anonymous cross-origin media requests", () => {
   };
 
   assert.equal(playbackCrossOrigin(publicBootstrap), "anonymous");
+  assert.equal(scriptedHlsAllowed(publicBootstrap, "https://www.rend.so/watch/asset"), true);
   assert.equal(startupPreloadHints(publicBootstrap, "hls")[0]?.crossOrigin, "anonymous");
 });
 

apps/site/lib/player-engine.test.mts

@@ -17,7 +17,7 @@ export type StartupPreloadHint = {
   artifactPath: string;
   as: "fetch" | "image" | "video";
   contentType?: string;
-  crossOrigin: "anonymous" | "use-credentials";
+  crossOrigin?: "anonymous";
   url: string;
 };
 
@@ -123,7 +123,25 @@ export function playbackCredentialMode(data: WatchPlaybackBootstrapResponse | nu
 }
 
 export function playbackCrossOrigin(data: WatchPlaybackBootstrapResponse | null | undefined) {
-  return playbackCredentialMode(data) === "omit" ? "anonymous" : "use-credentials";
+  // Tigris authorizes private playback with cookies, but its S3 CORS response
+  // does not include Access-Control-Allow-Credentials. Omitting crossorigin
+  // lets the media element use its credentialed no-CORS path; public playback
+  // remains explicitly anonymous and CORS-readable.
+  return playbackCredentialMode(data) === "omit" ? "anonymous" : undefined;
+}
+
+export function scriptedHlsAllowed(
+  data: WatchPlaybackBootstrapResponse | null | undefined,
+  pageUrl: string,
+) {
+  const ready = readyBootstrap(data);
+  if (!ready?.manifest_url) return false;
+  if (playbackCredentialMode(ready) === "omit") return true;
+  try {
+    return new URL(ready.manifest_url, pageUrl).origin === new URL(pageUrl).origin;
+  } catch {
+    return false;
+  }
 }
 
 function hlsStartupConfig(data: WatchPlaybackBootstrapReady) {
@@ -745,6 +763,12 @@ export function attachPlayback(
   const ready = readyBootstrap(options.initialBootstrap);
   telemetry?.playerLoad();
 
+  const applyCrossOrigin = (data: WatchPlaybackBootstrapReady | null) => {
+    const value = playbackCrossOrigin(data);
+    if (value) video.crossOrigin = value;
+    else video.removeAttribute("crossorigin");
+  };
+
   const applyProgressiveSource = (
     selection: SourceSelection,
     data: WatchPlaybackBootstrapReady | null = ready,
@@ -753,7 +777,7 @@ export function attachPlayback(
     setSelection(player, selection);
     setState(player, "ready");
     telemetry?.sourceSelected(selection);
-    video.crossOrigin = playbackCrossOrigin(data);
+    applyCrossOrigin(data);
     if (video.currentSrc !== selection.url && video.getAttribute("src") !== selection.url) {
       video.src = selection.url;
       setAttribute(player, "data-rend-src-assigned-ms", Math.max(0, Math.round(performance.now())));
@@ -775,7 +799,7 @@ export function attachPlayback(
       setSelection(player, selection);
       setState(player, "ready");
       telemetry?.sourceSelected(selection);
-      video.crossOrigin = playbackCrossOrigin(data);
+      applyCrossOrigin(data);
       if (!video.currentSrc && !video.getAttribute("src")) {
         video.src = selection.url;
         setAttribute(player, "data-rend-src-assigned-ms", Math.max(0, Math.round(performance.now())));
@@ -786,7 +810,11 @@ export function attachPlayback(
     }
 
     let Hls: HlsConstructor | null = null;
-    if (data.manifest_url && (options.playbackEngine === "mse" || !nativeHls)) {
+    if (
+      data.manifest_url &&
+      scriptedHlsAllowed(data, window.location.href) &&
+      (options.playbackEngine === "mse" || !nativeHls)
+    ) {
       try {
         Hls = await loadHlsConstructor();
       } catch {
@@ -812,7 +840,7 @@ export function attachPlayback(
     setSelection(player, selection);
     setState(player, "ready");
     telemetry?.sourceSelected(selection);
-    video.crossOrigin = playbackCrossOrigin(data);
+    applyCrossOrigin(data);
     video.removeAttribute("src");
     video.load();
     hls = new Hls(hlsStartupConfig(data));

apps/site/lib/player-engine.ts

@@ -129,13 +129,12 @@ The hosted architecture has no NAT gateway and no duplicate CDN:
 4. Fargate workers stream source ranges into ffmpeg instead of staging complete
    inputs. Each task has 4 vCPU, 8 GiB memory, and 100 GiB ephemeral storage.
    Attempts are immutable and a fenced PlanetScale lease alone can publish the
-   winning canonical media and public playback aliases.
+   winning canonical media and private playback aliases.
 5. The API and workers use PlanetScale over TLS. ClickHouse remains inside the
    VPC and is reached through the internal ALB's validated HTTPS hostname.
-6. The media bucket is private except for the immutable `v/*` alias prefix.
-   Canonical media, processing attempts, and all source objects remain private.
-   Asset UUIDs are unguessable, the public bootstrap already grants playback by
-   asset ID, and deletion removes canonical and alias keys.
+6. The media and source buckets are private. The API issues short-lived signed
+   cookies for immutable `v/*` aliases, while canonical media and processing
+   attempts remain inaccessible. Deletion removes canonical and alias keys.
 
 Default hard ceilings are API 2-6 tasks, workers 1-50, 50 non-deleted videos,
 250 GiB stored data, 10 open uploads, and two active media jobs per
@@ -150,8 +149,8 @@ billing controls.
 
 Terraform owns the external Tigris contract. Its idempotent reconciler reads
 credentials directly from SSM, creates missing buckets, and enforces a private
-source bucket, private canonical media, scoped public playback aliases, CORS,
-locations, and the custom domain. Credential values never enter Terraform
+source bucket, private media and playback aliases, CORS, locations, the signed
+playback key, and the custom domain. Credential values never enter Terraform
 state.
 
 See `infra/aws/README.md` for bootstrap, prerequisites, exact Terraform commands,

docs/deployment-aws.md

@@ -16,7 +16,7 @@ api.rend.so             video.rend.so
   |                         |
 AWS WAF + public ALB    Tigris delivery network
   |                         |
-TLS proxy               public v/* aliases only
+TLS proxy               signed private v/* aliases
   |                         |
 ECS API                 private canonical media
 
@@ -42,8 +42,8 @@ AWS log and backup traffic.
 
 - Tigris source and media buckets remain external to AWS, but Terraform owns
   their creation and security contract. Its apply-time reconciler reads the
-  credentials directly from SSM, then enforces a private source bucket, private
-  canonical media, scoped public `v/*` playback aliases, and CORS. Tigris
+  credentials directly from SSM, then enforces private source and media
+  buckets, signed `v/*` playback aliases, and CORS. Tigris
   object endpoints accept HTTPS only. Rend's 24-hour upload-session sweeper aborts each
   abandoned multipart upload and releases its reservation. Credential values never enter Terraform
   variables, plans, state, arguments, or logs.
@@ -130,8 +130,8 @@ Before the first platform apply:
    Tigris client used by CI: `npm install --global @tigrisdata/cli@3.4.3`.
 2. Create the ten SSM SecureString parameters referenced by the tfvars file. Secret
    values are populated outside Terraform so they do not enter state.
-3. Retain the legacy Tigris-compatible RSA key inputs until their existing SSM
-   values are rotated out. Public alias playback does not use signed cookies.
+3. Retain the Tigris-compatible RSA key inputs. The API signs short-lived
+   private playback cookies and Tigris verifies them at its custom domain.
 
    ```bash
    openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out cloudfront-private.pem

infra/aws/README.md

@@ -41,7 +41,7 @@ locals {
     { name = "REND_PLAYBACK_MODE", value = "tigris" },
     { name = "REND_PLAYBACK_BASE_URL", value = local.playback_base_url },
     { name = "REND_TIGRIS_PLAYBACK_BASE_URL", value = local.playback_base_url },
-    { name = "REND_PUBLIC_PLAYBACK_ENABLED", value = "true" },
+    { name = "REND_PUBLIC_PLAYBACK_ENABLED", value = "false" },
     { name = "REND_PUBLIC_PLAYBACK_ALIAS_ENABLED", value = "true" },
     { name = "REND_PUBLIC_PLAYBACK_ALIAS_BUCKET", value = var.tigris_media_bucket },
     { name = "REND_PUBLIC_PLAYBACK_ALIAS_PREFIX", value = "v" },

infra/aws/platform/locals.tf

@@ -130,7 +130,6 @@ ensure_bucket() {
   local bucket="$1"
   local location="$2"
   local cors_file="$3"
-  local allow_public_policy="${4:-false}"
   local bucket_info
   local expected_location
   local actual_location
@@ -161,7 +160,7 @@ ensure_bucket() {
     --bucket "$bucket" \
     --query 'PolicyStatus.IsPublic' \
     --output text)"
-  if [[ "$allow_public_policy" != "true" && "$public_policy" != "False" && "$public_policy" != "false" ]]; then
+  if [[ "$public_policy" != "False" && "$public_policy" != "false" ]]; then
     echo "Tigris policy is public for bucket $bucket" >&2
     exit 1
   fi
@@ -184,35 +183,7 @@ ensure_bucket() {
 }
 
 ensure_bucket "$TIGRIS_SOURCE_BUCKET" "$TIGRIS_SOURCE_LOCATION" "$work_dir/source-cors.json"
-ensure_bucket "$TIGRIS_MEDIA_BUCKET" "$TIGRIS_MEDIA_LOCATION" "$work_dir/media-cors.json" true
-
-# Only immutable playback aliases are anonymously readable. Canonical media,
-# processing attempts, and source objects remain private. Asset identifiers are
-# unguessable UUIDs and the public API already grants playback by asset ID, so
-# signed cookies add no authorization boundary while preventing credentialed
-# browser playback on Tigris's S3-compatible CORS responses.
-jq -n --arg bucket "$TIGRIS_MEDIA_BUCKET" '{
-  Version: "2012-10-17",
-  Statement: [{
-    Sid: "PublicReadPlaybackAliases",
-    Effect: "Allow",
-    Principal: "*",
-    Action: ["s3:GetObject"],
-    Resource: ["arn:aws:s3:::" + $bucket + "/v/*"]
-  }]
-}' >"$work_dir/media-policy.json"
-tigris_s3api_bucket_config put-bucket-policy \
-  --bucket "$TIGRIS_MEDIA_BUCKET" \
-  --policy "file://$work_dir/media-policy.json" >/dev/null
-
-media_public_policy="$(tigris_s3api get-bucket-policy-status \
-  --bucket "$TIGRIS_MEDIA_BUCKET" \
-  --query 'PolicyStatus.IsPublic' \
-  --output text)"
-if [[ "$media_public_policy" != "True" && "$media_public_policy" != "true" ]]; then
-  echo "Tigris playback alias policy is not public for bucket $TIGRIS_MEDIA_BUCKET" >&2
-  exit 1
-fi
+ensure_bucket "$TIGRIS_MEDIA_BUCKET" "$TIGRIS_MEDIA_LOCATION" "$work_dir/media-cors.json"
 
 playback_public_key_pem="$(printf '%s' "$TIGRIS_PLAYBACK_PUBLIC_KEY_PEM_B64" | base64 --decode)"
 if [[ "$playback_public_key_pem" != "-----BEGIN PUBLIC KEY-----"* ]]; then
@@ -263,4 +234,4 @@ aws ssm put-parameter \
   --overwrite \
   --no-cli-pager >/dev/null
 
-echo "Tigris private source/canonical media, public playback aliases, and custom playback domain are reconciled."
+echo "Tigris private source/media buckets, signed playback key, and custom playback domain are reconciled."

infra/aws/scripts/provision-tigris.sh

@@ -3343,7 +3343,7 @@ async fn api_fast_embed_inner(
         .as_deref()
         .map(|value| query_flag(Some(value), true))
         .unwrap_or(auto_play);
-    let inline_startup = if startup == "mse" {
+    let inline_startup = if startup == "mse" && playback_credential_mode == "omit" {
         fast_embed_inline_startup(
             state.as_ref(),
             &response,
@@ -5115,10 +5115,10 @@ fn render_api_fast_embed_html(
             html_escape(&selection.content_type)
         )
     };
-    let cross_origin = if playback_credential_mode == "omit" {
-        "anonymous"
+    let cross_origin_attr = if playback_credential_mode == "omit" {
+        r#" crossorigin="anonymous""#
     } else {
-        "use-credentials"
+        ""
     };
     let fetch_credentials = if playback_credential_mode == "omit" {
         "omit"
@@ -5131,18 +5131,18 @@ fn render_api_fast_embed_html(
             .first()
             .map(|url| {
                 format!(
-                    r#"<link rel="preload" as="fetch" href="{}" type="video/mp4" crossorigin="{}" fetchpriority="high">"#,
+                    r#"<link rel="preload" as="fetch" href="{}" type="video/mp4"{} fetchpriority="high">"#,
                     html_escape(url),
-                    cross_origin
+                    cross_origin_attr
                 )
             })
             .unwrap_or_default()
     } else if selection.content_type == "video/mp4" {
         format!(
-            r#"<link rel="preload" as="video" href="{}" type="{}" crossorigin="{}" fetchpriority="high">"#,
+            r#"<link rel="preload" as="video" href="{}" type="{}"{} fetchpriority="high">"#,
             html_escape(&selection.url),
             html_escape(&selection.content_type),
-            cross_origin
+            cross_origin_attr
         )
     } else {
         String::new()
@@ -5175,7 +5175,7 @@ body{{overflow:hidden}}
 </head>
 <body>
 <main class="rend-fast" aria-label="Video player" data-rend-player-state="ready" data-rend-player-selected="{label}" data-rend-player-artifact="{artifact_path}" data-rend-ready-status="ready" data-rend-source-state="{source_state}" data-rend-playable-state="{playable_state}" data-rend-playback-engine="{playback_engine}" data-rend-document-start-ms="0" data-rend-bootstrap-ms="0" data-rend-asset-id="{asset_id}">
-<video class="rend-fast__video"{source_attrs}{poster_attr}{auto_play_attr}{controls_attr}{muted_attr} playsinline preload="auto" crossorigin="{cross_origin}"></video>
+<video class="rend-fast__video"{source_attrs}{poster_attr}{auto_play_attr}{controls_attr}{muted_attr} playsinline preload="auto"{cross_origin_attr}></video>
 <div class="rend-fast__message" role="status" aria-live="polite">Ready</div>
 </main>
 <script>
@@ -5186,7 +5186,7 @@ body{{overflow:hidden}}
         asset_id = html_escape(&response.asset_id),
         artifact_path = html_escape(selected_artifact),
         auto_play_js = if auto_play { "true" } else { "false" },
-        cross_origin = cross_origin,
+        cross_origin_attr = cross_origin_attr,
         fallback_json = fallback_json,
         fetch_credentials = fetch_credentials,
         inline_startup_json = inline_startup_json,